A deployment can be designed to meet applicable HIPAA obligations, but a product label or signed agreement alone does not establish that it does. The assessment must cover the organisations involved, the protected health information processed and the actual technical and contractual arrangement.
HHS explains that a cloud provider creating, receiving, maintaining or transmitting electronic protected health information for a covered entity or business associate can itself be a business associate—even when it cannot view encrypted information. Appropriate agreements and compliance with applicable HIPAA requirements remain necessary. (hhs.gov)
For procurement, request:
- A diagram of the actual PHI flow.
- Identification of which parties are business associates or subcontractors.
- Appropriate business associate agreements for the arrangement.
- Approved uses, disclosures and limits on secondary use.
- Access controls, retention settings and incident procedures.
- A safe testing method using synthetic or appropriately de-identified data.
- A procedure for export, return or destruction at termination.
HHS’s business-associate contract guidance addresses safeguards, reporting, subcontractor obligations and handling PHI when the relationship ends. Use those requirements to review the arrangement, rather than treating the agreement as a badge. (hhs.gov)
Have the organisation’s privacy and security leads determine the applicable obligations. This checklist is procurement guidance, not a compliance certification or legal opinion.